Privacy Policy

1. Who we are — the data controllers

Jetique Circle ("Jetique Circle", "we", "us") is the flight-club platform available at jetiquecircle.com, owned and operated by Giovanni Nicola De Luca and Clara Maria Lombardo. They are the joint data controllers (Art. 26 GDPR) of the personal data described in this policy: together they decide why and how it is processed, and they are responsible for it towards you. You can contact them for any privacy matter, and exercise your rights with either of them, at admin@jetiquecircle.com.

2. Who builds and runs the software

The platform software and its server infrastructure are developed and managed on the controllers' behalf by destratis.it (Emilio Destratis). destratis.it acts only as a data processor (Art. 28 GDPR): it handles personal data solely on the controllers' documented instructions and only as far as needed to build, host, secure and maintain the platform. It does not decide the purposes of processing and does not use your data for its own purposes.

3. The personal data we collect

We collect the following categories of personal data:

• Account data: name, email address and password (stored only as a salted hash).
• Contact and identity data: phone number, country, date of birth and fiscal code / tax ID, where you choose to provide them.
• Travel documents: passport or ID scans you upload to your profile.
• Preferences: your Member Passport interests and flight preferences (departure places and destinations — countries, regions, cities or airports — periods and travel type), including the places you search flights for while “Add the places I search to my Member Passport” is ticked, and your notification preferences (what you receive, on which channel, and how new flights are matched to you).
• Marketing consent: whether you agreed to receive flights and offers matched to your interests, when and where you gave or withdrew it (at registration or in your preferences) and which version of the wording you saw.
• Notifications: the messages in your in-app inbox and whether you have read them, plus a delivery log of what we sent you and whether each email or push notification was delivered.
• Push notifications: if you switch them on for a device, that device's push subscription (an address on your browser's push service, with its encryption keys) and the browser it belongs to.
• Feedback: the 1–5 rating and any comment you leave after sending a request.
• Booking data: the flights, empty legs, shared seats and charter requests you submit, including dates, passenger counts and any notes.
• Communications: emails we exchange with you and the delivery status of transactional emails.
• Technical and usage data: IP address, device and browser type and, only with your consent, analytics data collected via Microsoft Clarity as described in our Cookie Policy.

4. How and why we use your data (legal bases)

Under the EU/UK General Data Protection Regulation (GDPR) we rely on the following legal bases:

• To create and manage your account and provide the platform — performance of a contract (Art. 6(1)(b)).
• To process and fulfil your booking, charter and empty-leg requests — performance of a contract.
• To send transactional messages (registration confirmation, updates on your requests, passport reminders) and occasional service messages about the platform itself (a new feature, a change to the service) in your inbox and by email — performance of a contract and our legitimate interest in keeping you informed (Art. 6(1)(f)). Service messages are never promotional.
• To send you flights and offers matched to your interests (flight alerts on any channel, and club news by email or push) — your consent (Art. 6(1)(a)), given with the single optional box at registration, when you turn notifications on after installing the app, or from your notification preferences. Without it you receive none of these messages, and you can withdraw it at any time with one switch.
• To send push notifications to a device — your consent, given when you switch push on and your browser asks for permission.
• To run analytics — your consent.
• To ask how sending a request went and keep your answer — our legitimate interest in improving the service; answering is always optional.
• To meet accounting, tax and other legal obligations — compliance with a legal obligation (Art. 6(1)(c)).
• To keep the platform secure and prevent abuse — our legitimate interest.

5. Cookies and analytics

We use strictly necessary cookies and local storage to keep you signed in, remember your theme and store your consent choice. With your explicit consent we also load Microsoft Clarity, a privacy-focused analytics tool, to understand how the site is used. You can accept, reject or change this at any time from the "Cookie settings" link in the footer. Full details are in our Cookie Policy.

6. Notifications, push and feedback

Messages reach you in your in-app inbox, by email and — if you switch it on for a device — as push notifications, even with the site closed. Messages about your own requests, and the occasional service message about the platform itself, are part of the service; flight alerts and club news by email or push need your consent. Flight alerts use the places in your Member Passport and the matching rule you choose (to or from your places, only your destinations, only your departures, your exact routes, or every new flight), and arrive as one message per batch of new flights. You can change any of this, or withdraw your consent, at any time from Notifications → Preferences. Push notifications are delivered through the push service of your browser (Google, Apple, Mozilla or Microsoft): their content is encrypted end to end, so the push service cannot read it. Right after you send a request we may ask you to rate the experience from 1 to 5; your answer is linked to your account so our team can follow up.

7. Who we share data with

We do not sell your personal data. We share it only with the service providers (processors) needed to run the platform, and with flight operators and brokers strictly to fulfil a booking you have requested. Our processors include:

• destratis.it — development, hosting management and maintenance of the platform software (European Union).
• IONOS — server hosting for the website, the application and its database, and DNS (European Union).
• Resend — transactional email delivery.
• Your browser's push service — Google Firebase Cloud Messaging, Apple Push Notification service, Mozilla Push Service or Microsoft Windows Push Notification Services — to deliver the push notifications you switched on (encrypted end to end).
• Microsoft Clarity — website analytics (only with your consent).

8. International data transfers

The website, the application and its database are hosted within the European Union. Some processors (such as Resend, Microsoft and the browser push services) may process data outside the EU/EEA. Where that happens, the transfer is protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an equivalent adequacy mechanism.

9. How long we keep your data

We keep your account data for as long as your account is active. Notifications, the delivery log, your notification preferences with the record of your consent, and your feedback are kept for as long as your account exists; a push subscription is removed as soon as you switch push off on that device or its push service reports it expired. When you delete your account we erase your personal data and related records (passport, documents, bookings, notifications, preferences, push subscriptions, feedback and lead submissions), except where we must retain certain information to comply with legal, tax or accounting obligations under Italian and EU law. Uploaded documents can be deleted individually from your profile at any time.

10. How we protect your data

Passwords are hashed with bcrypt and never stored in plain text. Data is transmitted over encrypted TLS connections and stored on access-controlled infrastructure. Access to personal data is limited to authorised personnel who need it to operate the service.

11. Your rights under the GDPR

If you are in the EU/EEA or UK, you have the right to:

• Access the personal data we hold about you, and obtain a copy — available instantly from "Download my data" in your profile.
• Rectify inaccurate data and complete incomplete data.
• Erase your data ("right to be forgotten") — available from "Delete my account" in your profile, or by emailing admin@jetiquecircle.com.
• Restrict or object to certain processing.
• Data portability — receive your data in a structured, machine-readable format.
• Withdraw consent at any time, without affecting processing already carried out — for flights and offers, with one switch in Notifications → Preferences.
• Lodge a complaint with your supervisory authority — in Italy, the Garante per la protezione dei dati personali (garanteprivacy.it).

12. Your rights under US privacy laws (CCPA/CPRA)

If you are a California resident (or a resident of a US state with comparable privacy law), you have the right to know what personal information we collect and why, to access and delete it, to correct it, and to opt out of the "sale" or "sharing" of personal information. We do not sell or share your personal information as those terms are defined under the CCPA/CPRA, and we do not use it for cross-context behavioural advertising. We will not discriminate against you for exercising these rights. To exercise them, use the tools in your profile or contact admin@jetiquecircle.com; we will verify your request against your account.

13. Children

The platform is intended for adults. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. Material changes will be reflected here with a new "last updated" date and, where appropriate, communicated to you. If we change how we use cookies or analytics, we will ask for your consent again.

15. Contact

For any privacy question or to exercise your rights, write to the data controllers, Giovanni Nicola De Luca and Clara Maria Lombardo, at admin@jetiquecircle.com.